Key Takeaways
- Deploying a verified logo (BIMI) traditionally required two separate vendors: a DMARC partner for policy enforcement and a Certificate Authority for the Mark Certificate, causing delays and complexity.
- Red Sift’s OnDMARC and GMO GlobalSign’s PKI now offer a single‑end‑to‑end solution that handles DMARC enforcement, BIMI activation, and the issuance of Verified or Common Mark Certificates.
-One of the biggest entry points for attackers because the protocol was designed without built‑in security. - Threat actors have moved from bulk spam to highly targeted spear‑phishing, exploiting the weak spots that grew as email became a core business channel.
- Defenders often treat email, web monitoring, DNS, and PKI as isolated silos, whereas attackers view the entire infrastructure as a single attack surface.
- Generative AI lowers the cost and skill barrier for malicious actors, enabling large‑scale, language‑agnostic attacks while also offering defensive uses when applied correctly.
- Security leaders should focus on fundamentals—good hygiene, proper DMARC configuration, and continuous monitoring—rather than chasing a mythical “silver bullet.”
- DMARC with at least a p=none policy is now a de‑facto requirement for sending to major providers (Google, Microsoft, Yahoo); BIMI adds a visible, trusted logo that benefits both security and marketing teams.
- Adoption of BIMI remains concentrated among large enterprises that prioritize brand protection, while overall DMARC deployment lags behind where it should be across the broader market.
- New CISOs are advised to adopt a holistic cybersecurity architecture, place DMARC early as a first line of defense, and maintain ongoing vigilance because attackers need only one success, whereas defenders must be prepared all the time.
The Traditional Fragmented Process for BIMI Deployment
Before the recent partnership, organizations that wanted a verified logo to appear next to their emails had to juggle two distinct workflows. First, they engaged a DMARC partner to set up and enforce DMARC records, which governs how receiving servers treat unauthenticated mail. Second, they procured a Mark Certificate from a trusted Certificate Authority (CA) to satisfy the BIMI specification’s requirement for cryptographic proof of brand ownership. This bifurcated approach introduced scheduling conflicts, extra contractual overhead, and often delayed projects as teams waited for each vendor to complete its piece of the puzzle. The inefficiency was especially painful for mid‑size firms lacking dedicated email‑security staff, pushing many to abandon BIMI altogether despite its clear benefits.
Red Sift and GlobalSign’s Integrated Solution
Red Sift’s OnDMARC platform now handles the DMARC enforcement side, providing policy publishing, monitoring, and remediation workflows in a single dashboard. GMO GlobalSign contributes the underlying public‑key infrastructure (PKI) that issues Verified Mark Certificates (VMCs) and Common Mark Certificates (CMCs)—the credentials that bind a brand’s logo to its domain in a tamper‑evident way. By bundling these capabilities, the two providers deliver a true end‑to‑end path: from certificate generation, through DMARC alignment, to the final display of a verified logo in the recipient’s inbox. Customers no longer need to negotiate separate contracts or manage disparate timelines; a single point of contact streamlines deployment, reduces operational friction, and accelerates time‑to‑value for both security and marketing initiatives.
Email’s Inherent Lack of Security
Email traces its origins to the early 1970s, a era when the primary concern was reliable message delivery rather than protection against abuse. Consequently, the core Simple Mail Transfer Protocol (SMTP) and related standards were designed without authentication, encryption, or integrity guarantees baked in. Over two decades, as email became the default conduit for business communications, marketing outreach, and internal collaboration, this foundational weakness manifested as a pervasive attack surface. Organizations that assumed email was “secure enough” found themselves exposed to spoofing, credential harvesting, and fraud, prompting a reevaluation of the protocol’s suitability for modern threat landscapes.
Evolution of Email Threats
Initially, attackers leveraged email for broad, low‑effort spam campaigns that relied on volume rather than precision. As spam filters improved, threat actors shifted tactics toward highly targeted spear‑phishing and business‑email compromise (BEC) schemes, which harvest credentials, trigger fraudulent wire transfers, or plant malware. These attacks exploit the human tendency to trust familiar sender addresses and often bypass traditional perimeter defenses because they appear legitimate. The slow adoption of available protections—such as SPF, DKIM, and DMARC—allowed these weaknesses to persist, turning email into a favored entry point for ransomware, data exfiltration, and reputational damage.
Attackers’ View vs Defenders’ Silos
From an attacker’s perspective, the organization’s digital infrastructure is a unified ecosystem: email, web services, DNS, and PKI are all potential vectors that can be chained together to achieve a foothold. Security teams, however, frequently manage these components in separate silos—email security groups focus on DMARC, web teams handle TLS certificates, DNS administrators monitor zone integrity, and PKI teams oversee certificate lifecycles. This fragmented view creates gaps where an attacker can exploit a weakness in one domain while defenders remain unaware because they are not correlating events across boundaries. Rahul Powar of Red Sift argues that a more integrated cybersecurity architecture, which treats all attack surfaces as interconnected, is essential to close these gaps and provide defenders with a holistic view of risk.
AI’s Role in Lowering Attack Barriers
The advent of cheap, capable generative AI models has dramatically altered the economics of cybercrime. Attackers no longer need to craft persuasive phishing lures manually; AI can generate convincing, context‑aware text in multiple languages, eliminating language as a barrier and enabling non‑native speakers to launch credible campaigns at scale. Mike Boyle of GMO GlobalSign notes that the same AI technology can be harnessed defensively—for example, to automate security‑operations‑center (SOC) analysis, filter malicious content, or detect anomalous patterns—but emphasizes that the dual‑use nature of AI means its impact depends on who wields it and with what safeguards. For malicious actors, the near‑zero cost of entry democratizes sophisticated attacks, while defenders must invest in AI‑aware detection and response capabilities to stay ahead.
Fundamentals Over Silver Bullets
Both Powar and Boyle caution against the allure of a single “silver bullet” solution that promises to eradicate email threats overnight. Instead, they advocate grounding security programs in fundamental hygiene: maintaining accurate DNS records, enforcing SPF and DKIM, deploying and monitoring DMARC policies, and regularly rotating cryptographic keys. When these basics are consistently applied, advanced controls like BIMI become meaningful enhancements rather than decorative add‑ons. A disciplined focus on fundamentals also builds organizational resilience, ensuring that even if a sophisticated attack bypasses one layer, other safeguards remain in place to limit impact.
DMARC as Mandatory Baseline and BIMI as Visible Trust Layer
Today, major email providers such as Google Workspace, Microsoft 365, and Yahoo Mail enforce a de‑facto requirement: senders must have at least a DMARC record with a policy of p=none (or stricter) to avoid having their messages relegated to spam folders or rejected outright. For organizations that operate at any scale on the internet, neglecting DMARC is effectively “doing it wrong.” BIMI builds on this foundation by adding a visually verifiable brand indicator—a logo that appears next to authenticated messages in the recipient’s inbox. This visible trust marker serves dual purposes: security teams gain confidence that only legitimate mail carries the logo, while marketing teams benefit from higher open and click‑through rates as recipients recognize and trust the branded signal. Red Sift tracks global BIMI uptake via bimiradar.com, showing steady growth as more brands achieve full DMARC compliance.
Adoption Concentrated in Large Enterprises
Despite the clear advantages, BIMI adoption remains uneven. Boyle observes that implementation is currently concentrated among large enterprises that guard their brands most jealously—companies with significant reputational risk and the resources to invest in PKI and DMARC infrastructure. Across the wider market, many small‑ and medium‑sized businesses still lack DMARC deployment, let alone the additional steps required for BIMI. This gap leaves a substantial portion of the email ecosystem exposed to spoofing and diminishes the collective security benefit that widespread BIMI could provide. Closing this divide will require education, simplified tooling, and perhaps incentives that lower the barrier to entry for smaller organizations.
Guidance for New CISOs
For those stepping into a chief information security officer role, Powar’s advice is to abandon the notion of a tidy, defensible perimeter. Modern attacks frequently traverse supply chains, partner networks, or customer touchpoints without ever crossing the corporate network boundary. Consequently, DMARC should be positioned early in the security stack—as a first line of defense that validates the authenticity of outbound and inbound mail before it reaches users. Layered beneath DMARC, organizations should implement account‑takeover detection, phishing‑simulation programs, and continuous monitoring of DNS and PKI health. Boyle stresses that enabling a control is only the beginning; DMARC must be continually watched, policies adjusted as threat intelligence evolves, and brand‑identity assurance kept tightly coupled to the authentication framework. Ultimately, defenders must accept that attackers need only one lucky break, while security must be perpetually prepared—making vigilance, integration, and foundational hygiene the cornerstones of a resilient email security posture.
